Old National Bancorp

In addition, the emergence, adoption and evolution of new technologies that do not require intermediation, including distributed ledgers, as well as advances in artificial intelligence and automation could significantly affect competition for financial services. For instance, in July 2025, President Trump signed into law the GENIUS Act, which establishes a regulatory framework for “payment stablecoins” and their issuers. Consumers and businesses may view payment stablecoins as a substitute for traditional bank deposits, resulting in deposit withdrawals. Depending on consumer and business interest in payment stablecoins, and the characteristics and utility of payment stablecoins, the passage of the GENIUS Act could result in increased competition with respect to Old National Bank’s deposit products. However, the GENIUS Act requires the U.S. Treasury Department and federal and state regulators to issue regulations on numerous topics to interpret and implement the statute, so the effect of the GENIUS Act will depend on what those regulations provide.

As our reliance on technology systems and the connectivity of third parties (including contractors) and electronic devices to our systems increase, the potential risks of technology-related interruptions in our operations or the occurrence of cyber incidents, including those resulting from the malicious introduction of destructive malware or ransomware, also increase. Our technologies, systems, and networks, and those of our external vendors, as well as our customers’ devices are periodically the target of cyberattacks and may be the target of future cyberattacks. Malicious actors, who are becoming increasingly sophisticated and may see their effectiveness enhanced by the use of artificial intelligence, deep-fake technologies, quantum computing and other novel technologies, may also attempt to fraudulently induce employees, customers or other users of our systems to disclose sensitive information, including passwords and other identifying information, in order to gain access to data or our systems.

The financial services industry is continually undergoing rapid technological change, including with respect to development and implementation of artificial intelligence solutions, and with frequent introductions of new technology-driven products and services. The effective use of technology increases efficiency and enables financial institutions to better serve clients and to reduce costs. Old National’s future success depends, in part, upon its ability to address client needs by using technology to provide products and services that will satisfy client demands, as well as to create additional efficiencies in Old National’s operations. Old National may not be able to effectively implement new technology-driven products and services or be successful in marketing these products and services to its clients. Failure to successfully keep pace with technological change affecting the financial services industry could negatively affect Old National’s growth, revenue, and profit.

The development and use of artificial intelligence presents risks and challenges that may adversely impact Old National’s business.

The use and development of artificial intelligence, including digital employees and digital engineers, by Old National and its third party vendors, clients, counterparties, and other market participants in certain business processes, models, including generative artificial intelligence models, services, or products may expose Old National to risks and potential liabilities. These risks may occur as a result of enhanced governmental or regulatory scrutiny, litigation, ethical concerns, confidentiality or other security risks, intellectual property concerns over data rights and protection, increased exposure to copyright infringement or intellectual property misappropriation claims, heightened susceptibility to cyberattacks, increased frequency and severity of cyberattacks, inaccurate or biased algorithms or underlying datasets, misuse or misappropriation as well as other factors that could adversely affect our business, reputation, and financial results. In addition, poor implementation of artificial intelligence by Old National or its third party service providers could subject Old National to additional risks that we may not adequately predict or mitigate.

The failure to strategically embrace the potential of artificial intelligence or to achieve the expected effectiveness, productivity, or cost-reduction from our adoption of artificial intelligence may result in a competitive disadvantage for us. If we cannot offer new artificial intelligence-facilitated technologies as quickly as our competitors, if our competitors develop more cost-effective solutions or other product offerings, if our employees do not adopt such technologies expediently, or if we are not able to source components we may require, such as artificial intelligence chips due to a supply chain shortage amid rising geopolitical uncertainty, we could experience a material adverse effect on our operating results, customer relationships, and growth opportunities. Our use and deployment of artificial intelligence solutions may introduce operational and control risks, including the risk of potential errors in automated decision-making, challenges in oversight and accountability, increased vulnerability to system failures or cyber incidents, and the risk that these technologies may not perform as intended under complex or unforeseen circumstances, which could materially disrupt our business operations and adversely affect our financial condition and reputation.

The evolving legal, regulatory, and compliance framework for artificial intelligence both in the U.S. and internationally may impact our ability to protect our own data and intellectual property against infringing use and could require changes in our implementation of artificial intelligence technology and increase our compliance costs and the risk of non-compliance. Our efforts to evolve our governance, risk management, and control frameworks to manage the novel and amplified risks from our use of artificial intelligence may be insufficient or ineffective, which could expose us to operational disruptions, legal and regulatory sanctions, reputational harm, and adverse financial impacts. Additionally, we may not be able to control how third-party artificial intelligence solutions that we choose to use are developed or maintained including the source and quality of the data on which such models are trained or the frequency and nature of model updates. We may also be unable to govern or protect the integrity of the data we input into such tools, with respect to how such data is retained, reused, co-mingled with other data or disclosed, even where we have sought protections with respect to these matters.

In addition, negative developments in the banking industry can result in increased regulatory scrutiny, in the course of routine examinations and otherwise, and new regulations, which may increase our cost of doing business and reduce our profitability. Among other things, there may be increased focus by both regulators and investors on deposit composition, the level of uninsured deposits, brokered deposits, unrealized losses in securities portfolios, liquidity, commercial real estate loan composition and concentrations, and capital as well as general oversight and control of the foregoing. Due to shifting political priorities and novel focus areas of regulators and other governmental authorities, we could also become subject to additional laws, rules and regulations relating to cybersecurity and data protection, digital assets, artificial intelligence and other emerging technologies, and financial market access. We could face increased scrutiny or be viewed as higher risk by regulators and/or the investor community, which could have a material adverse effect on our business, financial condition, and results of operations. See “Item 1 — Business — Supervision and Regulation” and Note 21 to the consolidated financial statements.

Despite our efforts to ensure the integrity of our systems, it is possible that we may not be able to anticipate or to implement effective preventive measures against all security breaches, especially because the techniques used change frequently or are not recognized until launched, and because security attacks can originate from a wide variety of sources, including persons who are involved with organized crime or associated with external service providers or who may be linked to terrorist organizations or hostile foreign governments. As cyber threats continue to evolve, including as a result of the increased use of artificial intelligence, we may be required to expend significant additional resources to continue to modify or enhance our systems or to investigate and remediate vulnerabilities. System enhancements and updates may also create risks associated with implementing and integrating new systems. Due to the complexity and interconnectedness of information technology systems, the process of enhancing our systems can itself create a risk of systems disruptions and security issues.